Cisco CyberOps Professional cheat sheet

CIA triad: Confidentiality (encryption/access control), Integrity (hashing/digital signatures), Availability (redundancy/DDoS protection).

NIST Incident Response Life Cycle: Preparation; Detection & Analysis; Containment, Eradication & Recovery; Post-Incident Activity.

SOC tiers: Tier 1 triage alerts; Tier 2 deep investigation; Tier 3 threat hunting and advanced forensics; Tier 4/lead manages strategy and metrics.

Key SOC metrics: MTTD (mean time to detect), MTTR (mean time to respond), alert volume, false positive rate, dwell time.

Log sources: firewall, IDS/IPS, proxy, DNS, endpoint EDR, authentication (AD/SSO), cloud audit trails (CloudTrail, Azure Activity Log).

Chain of custody: document who handled evidence, when, where, and why; use write blockers and hashing (SHA-256) to ensure integrity.

Incident severity classification (P1-P4) drives escalation; P1 = critical business impact, requires immediate response.

Regulatory drivers: GDPR (72-hour breach notification), PCI DSS (log retention 1 year, daily review), HIPAA (60-day breach notification).

Defense in depth layers: perimeter, network, endpoint, application, data; no single control is sufficient.

Cyber Kill Chain phases: Reconnaissance, Weaponization, Delivery, Exploitation, Installation, Command & Control, Actions on Objectives.

MITRE ATT&CK tactics (14): Recon, Resource Development, Initial Access, Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, C2, Exfiltration, Impact.

Detection rule types: signature (pattern match), anomaly (baseline deviation), behavioral (TTP-based), heuristic (rules of thumb).

False positive = benign activity flagged as malicious; false negative = malicious activity missed. Tune to balance precision and recall.

Indicators of Compromise (IOCs): hash, IP, domain, URL, registry key, filename. Indicators of Attack (IOAs): behaviors/TTPs.

YARA rules match malware families using strings, hex patterns, and conditions; used for file scanning and memory analysis.

Sigma rules are vendor-agnostic detection logic that convert to SIEM queries (Splunk, Elastic, QRadar).

Network detection: beaconing analysis (periodic C2), DNS tunneling (long/high-entropy queries), JA3/JA3S TLS fingerprinting.

Log correlation: combine multiple events (e.g., failed logins + successful login + privilege escalation) to raise high-fidelity alerts.

Order of volatility (RFC 3227): CPU registers/cache > RAM > swap > network state > running processes > disk > remote logs > archival media.

Containment strategies: isolation (network segment/VLAN), endpoint containment (EDR isolate), account disable, block IOCs at perimeter.

Eradication: remove malware, patch vulnerability, reset credentials, rebuild compromised hosts; recovery: restore from clean backups, monitor.

Forensic imaging: create bit-for-bit copy (dd, FTK Imager), verify hash before and after; work on copies, never originals.

Windows artifacts: Event ID 4624 (logon), 4625 (failed logon), 4688 (process creation), 7045 (service install), 4104 (PowerShell script block).

Linux artifacts: /var/log/auth.log, /var/log/syslog, ~/.bash_history, /etc/passwd, /etc/cron*, systemd journal.

Memory forensics: Volatility plugins (pslist, netscan, malfind, hashdump) reveal processes, network connections, injected code.

Timeline analysis: normalize timestamps (UTC), correlate host/network/application logs to reconstruct attacker sequence.

Post-incident: lessons learned meeting, root cause analysis, update playbooks, improve detection coverage (ATT&CK gap analysis).

Threat hunting loop: hypothesis generation → data collection → analysis → validation → new detection/automation.

Hunting hypotheses derive from ATT&CK gaps, threat intel reports, anomaly alerts, and environmental knowledge.

Threat intelligence levels: strategic (executive), operational (campaign/TTP), tactical (IOC), technical (malware analysis).

Intelligence sources: OSINT, commercial feeds, ISACs, dark web, malware sandboxes, CISA advisories.

TLP (Traffic Light Protocol): RED (limited), AMBER (limited distribution), GREEN (community), CLEAR (public).

IOC lifecycle: collection → normalization (STIX/TAXII) → enrichment → scoring (confidence) → deployment → aging out.

Pyramid of Pain: TTPs > tools > network/host artifacts > domain names > IPs > hash values (hardest for adversary to change at top).

Hunting techniques: stack counting, frequency analysis, outlier detection, peer group analysis, long-tail analysis.

Threat modeling frameworks: STRIDE (Spoofing, Tampering, Repudiation, Information disclosure, DoS, Elevation) and PASTA.

SOAR platforms (Splunk Phantom, Palo Alto Cortex XSOAR, IBM Resilient) automate playbooks, case management, and threat intel enrichment.

Playbook types: alert triage, phishing investigation, malware containment, vulnerability remediation, threat intel enrichment.

API integration: REST/SOAP APIs connect SIEM, EDR, firewall, ticketing (ServiceNow), and threat intel platforms.

Automation use cases: auto-enrich IOCs, auto-isolate endpoint, auto-create ticket, auto-block IP/domain, auto-notify stakeholders.

Security orchestration vs automation: orchestration coordinates tools/processes; automation executes repetitive tasks without human intervention.

Infrastructure as Code (IaC) security: scan Terraform/CloudFormation for misconfigurations (e.g., open S3 buckets) using tools like Checkov.

CI/CD security gates: SAST (static), DAST (dynamic), SCA (software composition analysis), secret scanning, container image scanning.

Machine learning in security: supervised (labeled data), unsupervised (anomaly detection), reinforcement learning (adaptive response).

Human-in-the-loop: high-impact actions (account disable, host isolation) require analyst approval; low-risk enrichment can be fully automated.